Ghidra Python - Get x-refs of a specific function

Question

What is the best way to get calling x-refs for a specific function?

I am aware of the following method:

func = getFirstFunction()

while func is not None:
    func_name = func.getName()
    if func_name == <my_func>:
        entry_point = func.getEntryPoint()
        references = getReferencesTo(entry_point)

func = getFunctionAfter(func)

Is there a way to do that without iterating through all the functions?

Answer 1

getReferencesTo takes an address

toAddr() converts a string to Address you can combine both

like this

>>> getReferencesTo(toAddr("ZwCreateKey"))

array(ghidra.program.model.symbol.Reference, 
[
From: 14095680c To: 1401b33c0 Type: DATA Op: 0 IMPORTED, 
From: 140a22fbd To: 1401b33c0 Type: DATA Op: 0 DEFAULT, 
From: Entry Point To: 1401b33c0 Type: EXTERNAL Op: -1 DEFAULT, 
From: 140628dc5 To: 1401b33c0 Type: UNCONDITIONAL_CALL Op: 0 DEFAULT, 
From: 1407478dd To: 1401b33c0 Type: UNCONDITIONAL_CALL Op: 0 DEFAULT, 
From: 1406bdfcd To: 1401b33c0 Type: UNCONDITIONAL_CALL Op: 0 DEFAULT, 
From: 1408db10c To: 1401b33c0 Type: UNCONDITIONAL_CALL Op: 0 DEFAULT, 
From: 1406f5dec To: 1401b33c0 Type: UNCONDITIONAL_CALL Op: 0 DEFAULT, 
From: 1407c7190 To: 1401b33c0 Type: UNCONDITIONAL_CALL Op: 0 DEFAULT, 
From: 1407d01da To: 1401b33c0 Type: UNCONDITIONAL_CALL Op: 0 DEFAULT, 
From: 1405a8745 To: 1401b33c0 Type: UNCONDITIONAL_CALL Op: 0 DEFAULT, 

the function limits its display to max 4096 refs if there are more use the recommended ReferenceManager

>>> refs = currentProgram.referenceManager.getReferencesTo(toAddr("ZwCreateKey"))
>>> for i in refs:
...     print i
... 
From: 14095680c To: 1401b33c0 Type: DATA Op: 0 IMPORTED
From: 140a22fbd To: 1401b33c0 Type: DATA Op: 0 DEFAULT
From: Entry Point To: 1401b33c0 Type: EXTERNAL Op: -1 DEFAULT
From: 140628dc5 To: 1401b33c0 Type: UNCONDITIONAL_CALL Op: 0 DEFAULT
From: 1407478dd To: 1401b33c0 Type: UNCONDITIONAL_CALL Op: 0 DEFAULT
From: 1406bdfcd To: 1401b33c0 Type: UNCONDITIONAL_CALL Op: 0 DEFAULT
From: 1408db10c To: 1401b33c0 Type: UNCONDITIONAL_CALL Op: 0 DEFAULT

Answer 2

I don't think there is a method that filters functions by name, but you can write the above a bit more concise with lambdas and a bit more functional approach.

fm = currentProgram.getFunctionManager()
funcs = fm.getFunctions(True)
filtered_funcs = filter(lambda f: f.getName() == '<your function name>', funcs)
x_refs = map(lambda f: getReferencesTo(f.getEntryPoint()), filtered_funcs)

You could even fold them more but (probably) hurting the readability.

Answer 3

This is possible via the Symbol Table:

sym = currentProgram.symbolTable.getSymbol(func_name)

func = currentProgram.functionManager.getFunction(sym.key)
# the following should be equivalent
func = currentProgram.functionManager.getFunctionAt(sym.address)

refs = getReferencesTo(func.entryPoint)

Symbols in this case are the Ghidra Function symbols, not the kind of symbols which might be contained in binary, but could be stripped. It works with names like FUN_100008628, entry, or any function you renamed.